Privacy policy
Last updated: 13 October 2026
This policy explains which personal data the FairMatch app (Android and iOS) and its related service process, why, for how long, and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003. The Italian version is the reference text.
1. Data controller
The controller is Giuliano Picilli. For any privacy request write to privacy@fairmatch.it.
2. What data we process
Account data
- Email, required to create the account and sign in.
- Password, if you sign up with email: we only store it as an irreversible hash, never in plain text.
- Verification codes sent by email at sign-up or password recovery, valid for a short time.
Sign in with Google
If you choose "Sign in with Google", Google shares with us, with your consent and only through the openid, email and profile scopes:
- your email address and whether it is verified;
- your name, which we suggest as your profile name (you can change it);
- the unique identifier of your Google account, to recognise you on later sign-ins.
We do not receive your Google password, we do not access Gmail, Drive, contacts, calendar or any other Google service, and we do not use your Google profile picture. Data received from Google is used only to create your account and sign you in: we do not sell it, use it for advertising or share it with third parties. FairMatch's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Player profile
- Name, visible to the other participants of the tournaments you join.
- Profile photo, optional, picked from your gallery or taken with the camera.
- Height and sex, optional: used only to balance the teams.
- Sports, roles and skill ratings that you enter; tournament admins can adjust them for that tournament.
Tournaments and games
- Tournaments you create or join, join requests, roles (owner, admin, player).
- Game days: date, chosen place (name and coordinates of the pitch), teams, results, votes on proposed line-ups, photo of the winning team.
- In-app notifications about activity in your tournaments.
Technical data
The server logs technical data needed for operation and security (for example IP address, date and time of requests, app version and errors). The app uses no third-party advertising, profiling or analytics tools and does not access your location.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating the account, signing you in (including with Google), verifying the email, recovering the password | Performance of a contract (Art. 6(1)(b) GDPR) |
| Building balanced teams, managing tournaments, game days, results and notifications | Performance of a contract (Art. 6(1)(b)) |
| Optional profile data (photo, height, sex) | Performance of a contract, at your choice: you can remove them at any time |
| Service security, abuse prevention, technical logs | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Who sees your data
Your name, photo, roles, ratings and results are visible to the other participants of the tournaments you join. Email and password are never shown to other users.
We use these providers, which process data on our behalf as processors:
- Microsoft Azure (Microsoft Ireland Operations Ltd.): servers, database and photo storage in the Italy North region; verification emails sent through Azure Communication Services with data in Europe.
- Google (Google Ireland Ltd.): only if you choose to sign in with Google, for authentication.
- komoot GmbH (Photon service, Germany): receives the text you type when searching for a pitch, with no data identifying you, to return matching places.
- Expo (650 Industries, Inc., USA): delivery of app updates. It receives the technical device data needed to download updates, with the safeguards required by the GDPR for transfers outside the EU (Data Privacy Framework or standard contractual clauses).
We do not sell your data or share it with third parties for marketing.
5. How long we keep it
- Account and profile data are kept while the account is active.
- When you delete your account in the app, we immediately delete email, password, photo, height, sex, sport profiles, Google link, join requests and notifications. In other users' tournaments past results remain, under an anonymous name.
- Verification codes expire after a few minutes; photos no longer linked to a profile or a game day are removed automatically.
- Technical logs are kept only as long as strictly needed for service security.
6. Your rights
You can request at any time access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest, by writing to privacy@fairmatch.it. You can edit your profile and delete your account directly in the app settings. If you sign in with Google you can also revoke FairMatch's access at myaccount.google.com/permissions.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.
7. Security
Communication between the app and the server is encrypted (HTTPS). Passwords are stored with PBKDF2 hashing and service keys in a protected vault. Photos are kept in private storage, not publicly accessible.
8. Minors
FairMatch is intended for people aged 14 or over. Anyone under 14 may use it only with the consent of a parent or legal guardian.
9. Changes
If we change this policy we update the date at the top; for significant changes we notify you in the app.